Ensure Connection Authentication Logging Is Enabled

高等級 1自動化cockroachdb

說明

CockroachDB can log client connection attempts, successful logins, authentication failures, and session disconnections through the SESSIONS logging channel. By default, this channel's logging is disabled to minimize overhead on all clusters. Runs cockroach sql with --certs-dir ${COCKROACH_CERTS_DIR:-/var/lib/cockroach/certs} (a root or admin client certificate must be in it); the target node comes from COCKROACH_HOST (default localhost:26257) or COCKROACH_URL. The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Passes when server.auth_log.sql_connections.enabled and server.auth_log.sql_sessions.enabled are both true.

檢查方式

稽核方法: SQL 查詢

sql_query

out=$(cockroach sql --certs-dir="${COCKROACH_CERTS_DIR:-/var/lib/cockroach/certs}" --format=csv --execute "SHOW CLUSTER SETTING server.auth_log.sql_connections.enabled; SHOW CLUSTER SETTING server.auth_log.sql_sessions.enabled;" 2>/dev/null) || exit 1; printf '%s\n' "$out" | grep -cx true || true

預期輸出: 2

修補方式

修補方法: 操作指南或基礎設施修補檔

SET CLUSTER SETTING server.auth_log.sql_connections.enabled = true; SET CLUSTER SETTING server.auth_log.sql_sessions.enabled = true; and keep the SESSIONS channel routed to cockroach-sql-auth.log.

屬性

作業系統: 不限
標籤: cockroachdbloggingauthentication
參考資料: CIS CockroachDB v25.x Benchmark v1.0.0 - 3.3 Ensure Connection Authentication Logging Is Enabled

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target cockroachdb